Linux – How to disable the DES and 3DES ciphers on Oracle WebLogic Server Node Manager Port(5556) in Red hat linux server

linuxweblogic

How to disable the DES and 3DES ciphers on Oracle WebLogic Server Node Manager Port(5556) in Red hat linux server. I tried with many solutions, but not working as expected. Here is my SSLCipherSuite code in ssl.conf file.

SSLCipherSuite SSL_RSA_WITH_RC4_128_MD5,SSL_RSA_WITH_RC4_128_SHA,SSL_RSA_WITH_3DES_EDE_CBC_SHA,SSL_RSA_WITH_DES_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,!aNULL,!eNULL,!LOW,!MD5,!EXP,!PSK,!SRP,!DSS,!RC4,!3DES

Best Answer

Remove the ciphers SSL_RSA_WITH_3DES_EDE_CBC_SHA and SSL_RSA_WITH_DES_CBC_SHA from your cipher list. You should also remove SSL_RSA_WITH_RC4_128_MD5 and SSL_RSA_WITH_RC4_128_SHA from the list as they are both considered insecure. I don't believe you get any benefit from the !aNULL,!eNULL,!LOW,!MD5,!EXP,!PSK,!SRP,!DSS,!RC4,!3DES specifications if you are listing individual ciphers.

If your server is internet accessible, consider running an SSLLabs Analysis on your server. If not, you could use nmap –script ssl-enum-ciphers to check your configuration.

You should be disabling the ciphers in your Java configuration. See: https://security.stackexchange.com/questions/120347/how-to-disable-weak-cipher-suits-in-java-application-server-for-ssl for details.

You may want to consider using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 and TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA. However, Java has had a problem with these ciphers causing 1 in 256 connections with standards compliant hosts to fail. This should be fixed in the latest release.

You should be able to set a secure set of ciphers by adding the ciphers to your Java command line. (Use only the last cipher unless you are on the latest Java version.)

-Dhttps.cipherSuites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA

If you want to use 256 bit encryption, duplication each cipher in order and change 128 to 256 in one of the duplicates. There doesn't seem to be a good reason to use 256 bits, and there are reports that using 256 bits may enable some timing attacks.

Related Solutions

Linux – How to start Oracle Enterprise manager after restarting the Red Hat Server

Try to re-configure em completely

emctl stop dbconsole
emca -repos drop
emca -repos create
emca -deconfig dbcontrol db
emca -config dbcontrol db

The best regards

Linux – How to run a server on port 80 as a normal user on Linux

Short answer: you can't. Ports below 1024 can be opened only by root. As per comment - well, you can, using CAP_NET_BIND_SERVICE, but that approach, applied to java bin will make any java program to be run with this setting, which is undesirable, if not a security risk.

The long answer: you can redirect connections on port 80 to some other port you can open as normal user.

Run as root:

# iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080

As loopback devices (like localhost) do not use the prerouting rules, if you need to use localhost, etc., add this rule as well (thanks @Francesco):

# iptables -t nat -I OUTPUT -p tcp -d 127.0.0.1 --dport 80 -j REDIRECT --to-ports 8080

NOTE: The above solution is not well suited for multi-user systems, as any user can open port 8080 (or any other high port you decide to use), thus intercepting the traffic. (Credits to CesarB).

EDIT: as per comment question - to delete the above rule:

# iptables -t nat --line-numbers -n -L

This will output something like:

Chain PREROUTING (policy ACCEPT)
num  target     prot opt source               destination         
1    REDIRECT   tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:8080 redir ports 8088
2    REDIRECT   tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80 redir ports 8080

The rule you are interested in is nr. 2, so to delete it:

# iptables -t nat -D PREROUTING 2

Best Answer

Related Solutions

Linux – How to start Oracle Enterprise manager after restarting the Red Hat Server

Linux – How to run a server on port 80 as a normal user on Linux

Related Topic